bat393 Privacy
Policy

1. Introduction

bat393 is an online casino and sports betting platform accessible at bat393.org, offering cricket betting, live dealer casino games, slots, and instant games to players in Pakistan. bat393 is committed to protecting the privacy and personal data of everyone who visits, registers on, or otherwise uses the bat393 platform.

This Privacy Policy ("Policy") sets out in clear, straightforward English exactly how bat393 handles your personal data. It describes what information bat393 collects, the purposes for which it is used, the limited circumstances in which it is shared with third parties, how long it is retained, and the rights available to you as a bat393 account holder.

This Policy should be read together with the bat393 Terms & Conditions and Responsible Gaming policy. Together these documents form the complete agreement between you and bat393. Where any conflict exists between this Policy and the Terms & Conditions, the Terms & Conditions shall take precedence on matters of contract, and this Policy shall take precedence on matters of data processing.

bat393 handles personal data responsibly, transparently, and in accordance with applicable data protection principles. bat393 does not collect personal data beyond what is genuinely necessary for the purposes described in this Policy, and does not retain it for longer than those purposes require.

2. Data We Collect

bat393 collects personal data in several categories depending on how you interact with the platform. The following table summarises the categories of personal data bat393 collects and the primary context in which each is obtained:

bat393 does not collect special categories of sensitive personal data such as health information, racial or ethnic origin, religious beliefs, or biometric data unless you voluntarily disclose such information in the context of a responsible gaming or self-exclusion request, in which case it is used solely to action your request.

3. How We Collect Data

bat393 collects personal data through the following channels:

• Direct Submission: When you complete the bat393 registration form, submit KYC documents, contact support, or interact with any form on the platform, you provide data directly to bat393.
• Automated Technical Collection: bat393's servers automatically log technical and usage data — including IP addresses, device identifiers, and page interaction data — whenever you visit bat393.org. This is standard practice for all web-based platforms.
• Cookies and Similar Technologies: bat393 uses cookies, local storage, and session tokens to maintain your login session, remember your preferences, and collect anonymised analytics data. See the Cookies section below for full details.
• Payment Processors: When you make a deposit or withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or a USDT crypto wallet, the relevant payment provider shares limited transaction confirmation data with bat393 to reconcile your account balance. bat393 does not receive your full payment credentials from these providers.
• Identity Verification Providers: bat393 may use third-party identity verification services to assist in the KYC process. These providers verify the authenticity of documents and confirm identity details against relevant databases. They act under strict data processing agreements with bat393.
• Fraud Prevention Services: bat393 works with third-party fraud detection providers who may share signals — such as device fingerprint risk scores or known fraudulent IP ranges — to help bat393 identify suspicious account activity. No raw personal data is shared with fraud services beyond what is strictly necessary for the risk assessment.

4. How We Use Your Data

bat393 uses your personal data only for clearly defined, legitimate purposes. The following table maps each processing purpose to its legal basis:

bat393 will never use your personal data for any purpose not listed above without first seeking your explicit consent. If bat393 identifies a new processing purpose, this Policy will be updated and registered users will be notified by email prior to the new processing commencing.

5. Data Sharing

bat393 does not sell your personal data. bat393 does not share your personal data with third-party advertisers or marketing networks. bat393 shares your data with external parties only in the following limited and necessary circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT crypto payment gateways receive only the minimum data required to process your transaction — typically your registered account name and transaction amount. These providers operate under their own privacy policies and are independently responsible for the data they process.
• Identity Verification Providers: bat393's KYC partners receive your identity document data and contact information for the sole purpose of verifying your identity and age. They are bound by strict data processing agreements and are not permitted to use your data for any other purpose.
• Game Software Suppliers: Third-party game providers whose games are hosted on bat393 receive anonymised session tokens and game-round data necessary to operate their games. They do not receive your name, CNIC, or contact details directly.
• Fraud and Security Providers: bat393 works with specialist fraud detection services that process technical and usage data to identify suspicious patterns. Data shared with these providers is minimised and governed by processing agreements.
• Regulatory and Legal Authorities: bat393 will disclose personal data to relevant regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law, court order, or regulatory directive. bat393 will notify affected users of such disclosures where legally permitted to do so.
• Professional Advisors: bat393's legal, audit, and accounting advisors may access limited personal data in the course of their professional engagements, subject to professional confidentiality obligations.

6. Payment Data

All PKR deposits and withdrawals on bat393 are processed through secure, third-party payment gateways. bat393 does not store your full JazzCash mobile number PIN, EasyPaisa MPIN, HBL internet banking credentials, UBL card numbers, Meezan Bank account passwords, or USDT wallet private keys on its servers at any time.

When you make a payment through any of bat393's supported methods, the following applies:

• Payment credentials are entered directly into the payment gateway's secure environment — not into bat393's own servers — through an encrypted payment frame or redirect.
• bat393 receives only a transaction confirmation token, masked payment identifier, and the transaction amount from the payment gateway once a transaction is complete.
• This transaction metadata is stored in your bat393 account history and retained for a minimum of five years to meet anti-money laundering record-keeping requirements.
• bat393 applies a strict policy of not accepting third-party payments. Deposits must originate from a payment account registered in the same name as your bat393 account, and withdrawals are paid only to that same registered payment method.

7. Cookies & Tracking Technologies

bat393 uses cookies and similar technologies — including local storage and session tokens — to operate core platform functionality, maintain your login session, and collect anonymised usage analytics. The following categories of cookies are used on bat393:

• Strictly Necessary Cookies: These cookies are essential for the bat393 platform to function. They maintain your login session, preserve your language and currency preferences, and enable the cashier to operate correctly. These cookies cannot be disabled without preventing core platform functions from working. No consent is required for strictly necessary cookies.
• Analytics Cookies: bat393 uses first-party analytics cookies to collect anonymised data about how users navigate the platform — including which pages are visited most frequently, how long users spend on each section, and where users exit the site. This data is used solely to improve the bat393 platform experience. IP addresses are anonymised before analytics data is processed.
• Fraud Prevention Cookies: bat393 uses technical cookies and device fingerprinting tokens to identify and flag suspicious login patterns, multiple-account behaviour, and bot activity. These are processed in bat393's legitimate interest of maintaining platform security.
• Marketing / Preference Cookies: If you consent to marketing cookies at login, bat393 may store anonymised preference data to personalise the promotional offers displayed in your account. You may withdraw marketing cookie consent at any time through your account settings.

You can manage or delete cookies at any time through your browser settings. Please be aware that disabling cookies beyond the marketing category may affect the functionality of the bat393 platform, particularly session management and cashier operations.

8. Data Retention

bat393 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

When a retention period expires, bat393 will securely delete or anonymise the relevant personal data. Where data is anonymised rather than deleted, the resulting anonymised dataset no longer constitutes personal data and is not subject to this Policy.

9. Security Measures

bat393 implements a layered approach to data security, combining technical controls, organisational procedures, and staff training to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure.

• Transport Security: All data transmitted between your browser or device and bat393's servers is encrypted using TLS 1.2 or higher with 256-bit SSL certificates. HTTP connections are automatically redirected to HTTPS.
• Server-Side Security: bat393's servers are hosted in secure data centres with physical access controls, network firewalls, intrusion detection systems, and regular penetration testing by independent security auditors.
• Access Controls: Internal access to personal data is governed by a strict role-based access control policy. Only staff members who genuinely require access to a category of personal data in order to perform their job functions are granted access. All access events are logged.
• Password Security: bat393 never stores account passwords in plain text. Passwords are hashed using industry-standard cryptographic algorithms. bat393 recommends that all players use a strong, unique password for their bat393 account and enable two-factor authentication (2FA).
• Incident Response: bat393 maintains a documented data breach response procedure. In the event of a confirmed data breach that is likely to result in a risk to the rights and freedoms of affected users, bat393 will notify those users without undue delay and will take immediate steps to contain the breach and prevent recurrence.

Despite these measures, no internet-based platform can guarantee absolute security. bat393 encourages all users to take their own precautions — including using unique passwords, enabling 2FA, and logging out of bat393 on shared or public devices.

10. Your Data Rights

bat393 respects your rights over the personal data we hold about you. The following rights are available to all bat393 account holders:

• Right of Access: You have the right to request a copy of all personal data bat393 holds about you. bat393 will provide this in a structured, commonly used electronic format within 30 days of a valid request. Requests should be submitted to [email protected] with the subject line "Data Access Request".
• Right to Rectification: If any personal data bat393 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account details directly in your bat393 profile. For changes to KYC identity data, contact [email protected] with supporting documentation.
• Right to Erasure: You may request the deletion of your personal data. bat393 will fulfil erasure requests where there is no overriding legal obligation to retain the data. Please note that AML regulations require bat393 to retain financial transaction records and KYC data for a minimum of five years following account closure, which takes precedence over erasure requests for this specific data.
• Right to Restrict Processing: You may request that bat393 restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another service provider where technically feasible.
• Right to Object: You have the right to object to bat393 processing your personal data on the basis of legitimate interests, including profiling for responsible gaming monitoring purposes. bat393 will review all objections and cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Marketing Consent: Where bat393 processes your contact data for marketing purposes on the basis of your consent, you may withdraw that consent at any time without affecting your account status or gaming access.

11. Minors & Age Verification

bat393 services are strictly limited to individuals who are 21 years of age or older. bat393 does not knowingly collect personal data from anyone under the age of 21 and does not permit anyone under 21 to register or use the bat393 platform in any capacity.

If you are a parent or guardian and you have reason to believe that a person under 21 in your care has registered on bat393, please contact [email protected] immediately. bat393 will investigate and, if confirmed, will close the underage account and return any real-money deposits to the originating payment method.

12. International Data Transfers

bat393 primarily processes and stores personal data on servers located in secure data centre facilities. Some of bat393's third-party service providers — including game software suppliers and fraud detection partners — may process data in jurisdictions outside Pakistan. Where such international transfers occur, bat393 takes the following steps to ensure your data remains protected:

• bat393 only engages third-party processors who can demonstrate adequate data protection standards through contractual commitments, including Data Processing Agreements that incorporate appropriate safeguards.
• bat393 conducts due diligence on third-party processors before onboarding them and reviews their data protection practices periodically.
• bat393 does not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual safeguards.

13. Changes to This Policy

bat393 may update this Privacy Policy from time to time to reflect changes in our services, applicable law, or data processing practices. When bat393 makes material changes to this Policy, the following process applies:

• The updated Policy will be published at bat393.org/privacy-policy with a revised "Last Updated" date at the top of the page.
• Registered bat393 account holders will be notified of material changes by email to the address registered on their account, at least 14 days before the changes take effect.
• Where a change requires fresh consent — for example, a new processing purpose that relies on consent as its legal basis — bat393 will seek that consent explicitly before the new processing commences.
• Continued use of bat393 services after the effective date of an updated Policy constitutes acceptance of the revised terms. If you do not agree with the updated Policy, you should cease using bat393 and may request account closure by contacting [email protected].

Minor corrections such as typographical fixes, formatting updates, or clarifications that do not alter the substance of how bat393 processes your data will be made without individual notification, though the "Last Updated" date will still be revised.

14. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or bat393's handling of your personal data, please contact the bat393 Data Protection team directly:

bat393 takes all privacy complaints seriously. Upon receiving a complaint, bat393 will acknowledge it within 5 business days, investigate the matter thoroughly, and provide a substantive written response within 30 calendar days. If you are not satisfied with bat393's response, you have the right to escalate your complaint to the relevant data protection or gaming regulatory authority in the jurisdiction applicable to your account.

bat393 encourages users to contact the support team directly in the first instance, as the majority of data privacy concerns can be resolved quickly and informally without the need for formal regulatory intervention. bat393's support team is available 24/7 in English and is experienced in handling data rights requests from Pakistani users.